Use calloc and reallocarray instead of malloc(a*b), malloc_zero(a*b), or realloc(p,a*b)
It's stupid and error-prone to multiply-then-malloc: you're just begging for an integer overflow. We should add a reallocarray (like OpenBSD uses) and use spatch/coccinelle to replace all our bad allocations.